Hi!

I'm lead developer for the @ipsos-simstore team. We are using pnpm as package manager in a @microsoft/rush based monorepo with 20 packages (10 apps, 10 libraries).

My problem

Some of these apps are Nest.js based backend apps. The Nest.js framework is split up into many packages that have their own internal and external dependencies, many of which are optional.

Only installing the peerDependencies that are in use by any one package duplicates the package once per set of peerDependencies that are installed.

I have setup a minimal reproduction repository at https://github.com/ipsos-simstore/pnpm-peer-dependency-repro for a concrete example.

$ pnpm ls -r
Legend: production dependency, optional only, dev only

lib@1.0.0 /Users/klingenm/Code/pnpm-peer-dependency-repro/packages/lib (PRIVATE)

devDependencies:
@nestjs/common 9.1.2
@nestjs/core 9.1.2
reflect-metadata 0.1.13
rxjs 7.5.7

microservice-app@1.0.0 /Users/klingenm/Code/pnpm-peer-dependency-repro/packages/microservice-app (PRIVATE)

dependencies:
@nestjs/common 9.1.2
@nestjs/core 9.1.2
@nestjs/microservices 9.1.2
lib link:../lib
reflect-metadata 0.1.13
rxjs 7.5.7

web-app@1.0.0 /Users/klingenm/Code/pnpm-peer-dependency-repro/packages/web-app (PRIVATE)

dependencies:
@nestjs/common 9.1.2
@nestjs/core 9.1.2
@nestjs/platform-express 9.1.2
lib link:../lib
reflect-metadata 0.1.13
rxjs 7.5.7

Lets say web-app is a http api, and microservice-app is backend only queue based thing. One needs the @nestjs/microservices package other just the @nestjs/platform-express packages.

the lib package has a peerDependency on @nestjs/core since it contains the dependency injection registry.

All peer dependency requirements are fulfilled.

$ pnpm install --strict-peer-dependencies
Scope: all 4 workspace projects
Lockfile is up to date, resolution step is skipped
Packages: +102
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Packages are hard linked from the content-addressable store to the virtual store.
  Content-addressable store is at: /Users/klingenm/Library/pnpm/store/v3
  Virtual store is at:             node_modules/.pnpm
Progress: resolved 102, reused 100, downloaded 0, added 102, done

I have a simple test to show the @nestjs/core is duplicated, and any modules/providers etc. created in lib will not be injectable by the DI system, since they are in the wrong registry maps.

$ cd packages/web-app
$ pnpm start

> web-app@1.0.0 start /Users/klingenm/Code/pnpm-peer-dependency-repro/packages/web-app
> node index.js

core === directCore false

Only (?) workaround

The only way I know of to get this working is to make sure all packages satisfy @nestjs/core's peerDependencies in the same way.

This PR visualize the change required to make the code work ipsos-simstore/pnpm-peer-dependency-repro#2

With the peerDependencies copied all over:

$ pnpm start

> web-app@1.0.0 start /Users/klingenm/Code/pnpm-peer-dependency-repro/packages/web-app
> node index.js

core === directCore true

This causes a bunch of devDependencies across the monorepo that are only there to de-duplicate some packages. I don't have an example, but having an optional peerDependency installed can affect the behavior of the main package (if it enables some feature if a peerDependency can be imported). This in turn could mean a package works differently when devDependencies are installed and when deployed with only production dependencies.

Just to be clear, this problem is limited to workspace-linked packages.

How I would like it to work

When lib is imported by another package, I would like the module resolver to ignore any packages defined in devDependencies.

I tried using the dependenciesMeta.*.injected option, which works as I would like, but it is completely unusable because it requires re-linking after any file addition (running tsc e.g) or removal. I even tried creating a post install hook that re-creates any injected packages directory entries into symlinks but that failed because of how rust handles deploy.

I have a feeling it could be possible to achieve this "devDependencies when not imported" feature using the pnp linker. I haven't had time to look at what runtime state the fs calls have access to.

For now, I'll make some custom pollinator tool and a detector for duplicated packages. Should be easy enough in the afterAllResolved hook.

I did search for similar discussions:

• Duplicate dependency of the same package #4817
• Figuring out why PNPM resolves a different peer dependency? #4827
• Two copies of the same version of the package #4051
• PNPM install does not differentiate between optional and required peer dependencies in installed packages #4465
• pnpm install duplicate package with same version #3897

They are all somewhat similar, but did not say wether the problem is related to devDependencies etc.